Re: [PATCH] xfs: fix slab-use-after-free in xrep_newbt_free()

[Carlos Maiolino <cem@kernel.org>]

On Fri, Oct 16, 2026 at 10:16:18PM +0800, Zheng Shuhao wrote:
> Hi Carlos,
> 
> Thank you for the pointer, and my apologies for the confusion. This is
> my first patch submission to the Linux kernel, and I was not aware of the

Please keep the context when replying and respond to messages "inline".
Giving this is your first patch, I'd suggest skimming through the guidelines
in the kernel documentation.

> known-identity requirement for patch authorship and Signed-off-by.
> Understood now; I will use my real name for all future submissions:
> 
>     Zheng Shuhao <viennaoffh@gmail.com>
> 
> (vienna-0FFH was my GitHub handle only.)
> 
> For reference, this is the testing I did on the patch before posting:
> 
>  * Built the patched tree with KASAN + XFS_DEBUG enabled; checkpatch.pl
>    --strict reports 0 errors and 0 warnings.

Good.

>  * Reproduced the use-after-free deterministically in QEMU on an
>    unpatched kernel; the KASAN splat matches the syzbot report exactly
>    (xfs_defer_item_unpause <- xrep_newbt_free <- xrep_bmap_build_new_fork,
>    and the xfs_defer_pending object is freed by xfs_defer_finish_noroll).
>  * With the patch applied, the same trigger produces no KASAN report: the
>    scrub ioctl just returns -EIO and the shutdown path unwinds cleanly.
>  * Regression runs on the patched kernel: all metadata scrub types,
>    invalid scrub inputs (bad flags/generation/agno/type), and forced bmap
>    btree rebuilds from 5 up to 1500 extents (covering both extents- and
>    btree-format forks), with read-back verification of the files. No
>    regressions; normal scrub/repair paths still succeed.
> 
> I can share the reproducer and test scripts if that is useful.

Yes, sharing the reproducer (and potentially hooking it up into
xfstests) is a good thing, specially giving the syzbot doesn't seem
to have a reproducer for it yet.

I'm also interested if you actually passed your patch through xfstests
before submitting it. There is no good fixing a bug if you create a
handful of others. Specialy agains scrub, online_repair (and maybe
fsstress_scrub) groups.

> 
> Would you prefer that I resend this as v2 with the correct
> From:/Signed-off-by: lines, or can you fix up the authorship when
> applying? Either way works for me.

You'll need to send a V2. But wait until your patch gets reviewed, you
don't need to send it right now.


> 
> Thanks,
> Zheng Shuhao
>